From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Original-To: caml-list@yquem.inria.fr Delivered-To: caml-list@yquem.inria.fr Received: from mail3-relais-sop.national.inria.fr (mail3-relais-sop.national.inria.fr [192.134.164.104]) by yquem.inria.fr (Postfix) with ESMTP id 21F5BBC37 for ; Thu, 17 Dec 2009 12:57:03 +0100 (CET) X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AsEIAOOqKUuGnQCBZGdsb2JhbACECpR2gkUaCA0FFQOpXzWPcIEvgixSBA X-IronPort-AV: E=Sophos;i="4.47,412,1257116400"; d="scan'208";a="40070951" Received: from shiva.jussieu.fr ([134.157.0.129]) by mail3-smtp-sop.national.inria.fr with ESMTP; 17 Dec 2009 12:57:02 +0100 Received: from hydrogene.pps.jussieu.fr (hydrogene.pps.jussieu.fr [134.157.168.1]) by shiva.jussieu.fr (8.14.3/jtpda-5.4) with ESMTP id nBHBtkNO096835 ; Thu, 17 Dec 2009 12:55:46 +0100 (CET) X-Ids:166 Received: from [IPv6:::1] (hydrogene.pps.jussieu.fr [134.157.168.1]) by hydrogene.pps.jussieu.fr (8.13.4/jtpda-5.4) with ESMTP id nBHBtiJ9024734 ; Thu, 17 Dec 2009 12:55:44 +0100 Message-ID: <4B2A1C27.8050704@pps.jussieu.fr> Date: Thu, 17 Dec 2009 12:55:19 +0100 From: Mehdi Dogguy User-Agent: Mozilla-Thunderbird 2.0.0.22 (X11/20090707) MIME-Version: 1.0 To: Pierre Weis Cc: caml-list@inria.fr Subject: Re: [Caml-list] New 3.0.2 release of the Caml Images library References: <20091117102310.C6F2D5A38@deby.inria.fr> In-Reply-To: <20091117102310.C6F2D5A38@deby.inria.fr> X-Enigmail-Version: 0.95.0 OpenPGP: id=8C2ED8FF Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Virus-Scanned: ClamAV 0.94.2/10194/Thu Dec 17 10:32:19 2009 on shiva.jussieu.fr X-Virus-Status: Clean X-Miltered: at jchkmail2.jussieu.fr with ID 4B2A1C42.001 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-j-chkmail-Enveloppe: 4B2A1C42.001/134.157.168.1/hydrogene.pps.jussieu.fr/hydrogene.pps.jussieu.fr/ X-Spam: no; 0.00; weis:01 bug:01 packagers:01 bug:01 2009:98 W8:98 W10:98 wrote:01 pps:01 pps:01 caml-list:01 jussieu:01 jussieu:01 pierre:02 caml:02 Pierre Weis wrote: > > This is a bug fix release. > There is still a security issue not fixed in this release which concerns TIFF images. A CVE has been announced a while ago: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3296 I tried to contact the authors (one month ago) but received no answer yet. That's why I'm sending this message on the list: to let users and packagers know about the bug. The vulenarable file is “src/tiffread.c”. The patch is available at: http://tinyurl.com/cve-tiff-1 and the source code of “oversized.h” is available at: http://tinyurl.com/cve-tiff-2 These changes are applied in the Debian packages and were backported to the stable and oldstable releases. Best regards, -- Mehdi Dogguy مهدي الدڤي http://www.pps.jussieu.fr/~dogguy Tel.: (+33).1.44.27.28.38